Landing zone design in Google Cloud

Last reviewed 2023-08-31 UTC

This document provides an overview on how to design landing zones in Google Cloud. A landing zone, also called a cloud foundation, is a modular and scalable configuration that enables organizations to adopt Google Cloud for their business needs. A landing zone is often a prerequisite to deploying enterprise workloads in a cloud environment.

A landing zone is not a zone or zonal resources.

This document is aimed at solutions architects, technical practitioners, and executive stakeholders who want an overview of the following:

  • Typical elements of landing zones in Google Cloud
  • Where to find detailed information on landing zone design
  • How to deploy a landing zone for your enterprise, including options to deploy pre-built solutions

This document is part of a series that helps you understand how to design and build a landing zone. The other documents in this series help guide you through the high-level decisions that you need to make when you design your organization's landing zone. In this series, you learn about the following:

This series does not specifically address compliance requirements from regulated industries such as financial services or healthcare.

What is a Google Cloud landing zone?

Landing zones help your enterprise deploy, use, and scale Google Cloud services more securely. Landing zones are dynamic and grow as your enterprise adopts more cloud-based workloads over time.

To deploy a landing zone, you must first create an organization resource and create a billing account, either online or invoiced.

A landing zone spans multiple areas and includes different elements, such as identities, resource management, security, and networking. Many other elements can also be part of a landing zone, as described in Elements of a landing zone.

The following diagram shows a sample implementation of a landing zone. It shows an Infrastructure as a Service (IaaS) use case with hybrid cloud and on-premises connectivity in Google Cloud:

Example architecture for a landing zone.

The example architecture in the preceding diagram shows a Google Cloud landing zone that includes the following Google Cloud services and features:

The diagram above is only an example, because there is no single or standard implementation of a landing zone. Your business must make many design choices, depending on different factors, including the following:

  • Your industry
  • Your organizational structure and processes
  • Your security and compliance requirements
  • The workloads that you want to move to Google Cloud
  • Your existing IT infrastructure and other cloud environments
  • The location of your business and customers

When to build a landing zone

We recommend that you build a landing zone before you deploy your first enterprise workload on Google Cloud, because a landing zone provides the following:

  • A foundation that's designed to be secure
  • The network for enterprise workloads
  • The tools that you require to govern your internal cost distribution

However, because a landing zone is modular, your first iteration of a landing zone is often not your final version. Therefore, we recommend that you design a landing zone with scalability and growth in mind. For example, if your first workload does not require access to on-premises network resources, you could build connectivity to your on-premises environment later.

Depending on your organization and the type of workloads that you plan to run on Google Cloud, some workloads might have very different requirements. For example, some workloads might have unique scalability or compliance requirements. In these cases, you might require more than one landing zone for your organization: one landing zone to host most of the workloads and a separate landing zone to host the unique workloads. You can share some elements such as identities, billing, and the organization resource across your landing zones. However, other elements, such as the network setup, deployment mechanisms, and folder-level policies, might vary.

Elements of a landing zone

A landing zone requires you to design the following core elements on Google Cloud:

In addition to these core elements, your business might have additional requirements. The following table describes these elements and where you can find more information about them.

Landing zone element Description
Monitoring and logging Design a monitoring and logging strategy that helps ensure all relevant data is logged and that you have dashboards that visualize the data and alerts that notify you of any actionable exceptions.
For more information, see the following:
Backup and disaster recovery Design a strategy for backups and disaster recovery.
For more information, see the following:
Compliance Follow the compliance frameworks that are relevant to your organization.
For more information, see the Compliance resource center.
Cost efficiency and control Design capabilities to monitor and optimize cost for workloads in your landing zone.
For more information, see the following:
API management Design a scalable solution for APIs that you develop. For more information, see Apigee API Management.
Cluster management

Design Google Kubernetes Engine (GKE) clusters that follow best practices to build scalable, resilient, and observable services.

For more information, see the following:

Best practices for designing and deploying a landing zone

Designing and deploying a landing zone requires planning. You must have the right team to perform the tasks, and use a project management process. We also recommend that you follow the technical best practices that are described in this series.

Build a team

Bring together a team that includes people from multiple technical functions across the organization. The team must include people who can build all landing zone elements, including security, identity, networks, and operations. Identify a cloud practitioner who understands Google Cloud to lead the team. Your team should include members who manage the project and track achievements, and members who collaborate with application or business owners.

Make sure that all stakeholders are involved early in the process. Your stakeholders must come to a common understanding of the scope of the process and make high-level decisions when the project gets kicked off.

Apply project management to your landing zone deployment

Designing and deploying your landing zone can take multiple weeks, so project management is essential. Ensure that project goals are clearly defined and communicated to all stakeholders and that all parties receive updates on any project changes. Define regular checkpoints and agree on milestones with realistic timelines that take operational processes and unexpected delays into account.

To best align with business requirements, plan the initial landing zone deployment around the use cases that you want to deploy first in Google Cloud. We recommend that you first deploy workloads that can most easily run on Google Cloud, such as horizontally scaling multi-tier web applications. These workloads might be new or existing workloads. To assess existing workloads for migration readiness, see Migration to Google Cloud: Getting started.

Because landing zones are modular, center the initial design around the elements that are required to migrate your first workloads and plan to add other elements later.

Follow technical best practices

Consider using Infrastructure as Code (IaC), with, for example, Terraform. IaC helps you make your deployment repeatable and modular. Having a CI/CD pipeline that deploys cloud infrastructure changes using GitOps helps you ensure that you follow internal guidelines and put the right controls in place.

When you design your landing zone, ensure that you and your team take technical best practices into consideration. For more information on decisions to make in your landing zone, see the other guides in this series.

In addition to this series, the following table describes frameworks, guides, and blueprints that can also help you follow best practices, depending on your use cases.

Related documentation Description
Google Cloud setup checklist A high-level checklist to help you set up Google Cloud for scalable, production-ready, enterprise workloads.
Security foundations blueprint An opinionated view of Google Cloud security best practices, aimed at CISO, security practitioners, risk managers, or compliance officers.
Google Cloud architecture framework Recommendations and best practices to help architects, developers, administrators, and other cloud practitioners design and operate a cloud topology that's secure, efficient, resilient, high-performing, and cost-effective.
Terraform blueprints A list of blueprints and modules that are packaged as Terraform modules and that you can use to create resources for Google Cloud.

Identify resources to help implement your landing zone

Google Cloud offers the following options to help you set up your landing zone:

All these offerings have approaches that are designed specifically to meet the needs of different industries and business sizes, across the globe. To help you make the best selection for your use case, we recommend that you work with your Google Cloud account team to make the selection and help to ensure a successful project.

What's next